PT-2026-22616 · Chamilo · Chamilo

Publicado 2026-03-02 · Atualizado 2026-03-07 · CVE-2025-52469

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo is a learning management system. A logic issue in the friend request workflow of Chamilo’s social network module allows an authenticated user to add any user as a friend by directly calling an AJAX endpoint. The attacker bypasses the normal friend request process, and can even add non-existent users. This breaks access control and social interaction logic, potentially impacting privacy. The vulnerable endpoint is an AJAX endpoint used for managing friend requests. The issue is exploitable by any authenticated user, allowing them to manipulate the friend request workflow.

Recommendations Update to version 1.11.30 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-841

Identificadores relacionados

CVE-2025-52469

GHSA-M5XJ-5XF3-RQCH

Produtos afetados

Chamilo

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52469.json · Exploit
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Nota
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-m5xj-5xf3-rqch · Aviso do Fabricante
• https://github.com/chamilo/chamilo-lms/commit/39e0fa88a2ba5dd197e0d8ce7335730b666992a6 · Correção
• https://twitter.com/cracbot/status/2030237135169831023 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-52469 · Nota de Segurança
• https://twitter.com/cracbot/status/2029512380498206847 · Publicação no Twitter
• https://twitter.com/cracbot/status/2029874840124149886 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-52469 · Aviso do Fabricante